Ubuntu Hacked down
Ubuntu Hacked down, all form the past some years I was thinking the same that Ubuntu cannot be hacked; this is why, I recommend most of my clients and friends to used. Now the question is how we get our self safe?
Official Ubuntu Forum hacked. It seems that Canonical (parent company of Ubuntu) has fallen prey to obnoxious hackers this time. Ubuntu’s official forum ubuntuforums.org website has hacked by a hacker named
@Sputn1k. Hacker defaced the website and displayed this page on the homepage.
ubuntuforums.org website has been down for couple of hours now and users can not access it. There is no official word from Ubuntu over this hack but they seem to be aware of the issue. Ubuntu community team member Jorge Castro acknowledged that Canonical is aware of the issue:
Canonical IS is aware and working on the problem.
There is no more information available at present. It cannot be made sure
if it was just a website defacement hack or if the hacker got access to the database and thus user credential. If hacker got access to users credential then Canonical will the latest victim in the series of Sony, LinkedIn and some other big companies that got hacked recently. Even if it is a website defacement, it is still a (minor) embarrassment for Ubuntu.
The official website confirm this breach.
There has been a security breach on the Ubuntu Forums. The Canonical IS team is working hard as we speak to restore normal operations. If you’re using Ubuntu and need technical support please see the following page for support:
Ubuntu support forums users must have to look for dodgy emails after the website’s database of 2 million email addresses was stolen.
Canonical announced the security breach on Friday after being notified that someone was claiming to have a copy of the UbuntuForums.org database. An investigation revealed that an attacker did get access to the website’s user records through a vulnerability.
The exploited SQL injection flaw was located in the Forum Runner add-on for vBulletin, commercial web forum software that powers over 100,000 community websites on the Internet and is especially popular with companies. The vulnerability was known, the Canonical IS team fail to apply the patch for it in a timely manner.
“The attacker had the ability to inject certain formatted SQL to the Forums database on the Forums database servers,” the team said in a blog post. “This gave them the ability to read from any table but we believe they only ever read from the ‘user’ table.”Building a toy social network with Python, Part 1: The databasehttps://imasdk.googleapis.com/js/core/bridge3.439.0_en.html#goog_1268618451Volume 0%
The user table contained usernames, email addresses and Internet Protocol addresses for 2 million users. It did not contain valid user passwords, but hashed strings that were used for the Ubuntu Single Sign On service. These cannot be used as is to access user accounts.
As a precautionary measure to ensure that no attacker code was left behind, Canonical temporarily took the website down, rebuilt its hosting servers from scratch, installed the most up to date version of vBulletin and reset all system and database passwords.
The company is certain that the attacker was not able to access any code repositories or update mechanisms, did not get write permissions to the Ubuntu Forums database, didn’t obtain shell access any of the servers and was not able to mess around with any other Canonical or Ubuntu services.